Free WordPress Security Audit — Claude AI Skill

Q: Is this tool really free?

Yes. No signup, no trial, no email gate. Built as a lead-generation asset for Macronimous; use it as often as you'd like.

Q: Which hosts does Full mode work with?

Any host providing SSH with WP-CLI: Hostinger, SiteGround, Bluehost, Kinsta, WP Engine, Cloudways, and most VPS setups. Shared-hosting-specific guidance is included.

Q: Does it replace a professional security audit?

It replaces the first 80%: inventory, CVE matching, configuration review, and obvious-compromise checks. It does not replace penetration testing or incident response.

Q: Can I modify or redistribute it?

Yes. MIT licensed. Fork it, adapt it, share it. We only ask that the tool credit line stays in generated reports.

The WP Security Audit skill is a free, open-source Claude AI skill that audits any WordPress site for known plugin vulnerabilities, malware, weak configuration, and existing compromises. It runs read-only checks from outside WordPress itself, produces a prioritized fix list, and takes about five minutes to install.

Why a security plugin can't certify its own environment

Most WordPress security tooling runs as a plugin. Think about what that means: the scanner executes inside the same PHP runtime the malware controls. A compromised site can feed the plugin clean results, hide files from PHP-level scans, or quietly modify the scanner itself. You cannot certify an environment from inside it. This is the same reason forensics teams pull the disk instead of running antivirus on a machine they suspect is infected.

This skill takes the opposite approach. It inspects your site from the outside: over SSH at the shell level, where WordPress-level malware can't intercept the checks, and over plain HTTP for the externally visible surface. Core files get verified against wordpress.org's official checksums, not against what your dashboard claims. That distinction matters more than any feature list.

A security scanner running inside WordPress is auditing itself with the suspect's own tools. Real audits happen from outside the environment they're judging.

What it actually checks

The audit focuses effort where WordPress breaches actually happen. Core itself is rarely the problem; plugins, themes, configuration, and already-present compromises are.

Every plugin and theme version cross-checked against the WPScan and Patchstack vulnerability databases
Abandoned plugins (no update in 2+ years) and premium plugins bundled inside themes, which chronically lag behind patched versions
Core file integrity via wordpress.org checksums, catching injected or modified files
wp-config.php hardening: debug flags, salts, file-edit lockdown, exposed backup copies
Malware signatures: PHP files in uploads, obfuscated code, rogue admin accounts, injected .htaccess redirects, known backdoor families like wp-vcd
File permissions, exposed database dumps, leaked .env and .git directories
External surface: xmlrpc.php, user enumeration, directory listing, security headers
Targeted code review of your highest-risk plugins: anything handling uploads, forms, AJAX, or payments

Everything is read-only. No exploit attempts, no brute forcing, no payloads. You can run it against a production site without risk.

An audit, not a code review

Most AI-assisted WordPress security tooling reviews code you're writing: it reads a repository and flags bad patterns before you ship. Useful, but that's not where sites get hacked. Sites get hacked in production, through plugins someone installed three years ago and a configuration nobody has looked at since launch.

This skill audits the site you're actually running. Four things follow from that, and each is rare in this space:

It works against the live server. Real installed versions, real file permissions, real exposed files, checked over SSH, not what a repository or a dashboard claims.
It checks whether you're already compromised. Code review assumes a clean starting state. This skill doesn't: it hunts for rogue admin accounts, PHP planted in your uploads folder, poisoned .htaccess redirects, and known backdoor families before judging anything else.
The report is written for two readers at once. Plain-language risk descriptions a business owner can act on, with the technical detail underneath for whoever does the fixing. Agencies can put their own name on it as preparer.
It states its own limits. The report says which mode ran, what was verified, and what wasn't. An audit that overstates its coverage is a liability, not a deliverable.

Two modes, depending on what access you have

Mode	What you need	What you get
Remote	Just the site URL	External surface audit: exposed files, version disclosure, user enumeration, headers, visible plugin versions matched against CVEs
Full	SSH access with WP-CLI (standard on Hostinger, SiteGround, and most modern hosts)	Everything in Remote, plus core checksums, complete plugin inventory, config audit, malware scan, and code review

Full mode is where the real value is. If your host gives you SSH, use it. The skill will tell you plainly which mode it ran in and what the other mode would have added, because a partial audit presented as a complete one is worse than no audit.

The report: three tiers, exact fixes

Every finding lands in one of three tiers:

Critical — actively exploitable or evidence of existing compromise. Fix within 24–48 hours.
Important — meaningful risk reduction. Fix within two weeks.
Polish — hardening and hygiene, when convenient.

Every finding comes with the exact fix, the command, config line, or plugin action, because "consider improving your security posture" is not advice anyone can act on. The report also lists what passed: an audit that's all failures reads as fear-selling, and we don't do that.

We've maintained WordPress sites for clients since 2002, and the pattern never changes: sites that look fine in the dashboard carry abandoned plugins with public CVEs, bundled slider plugins three versions behind their patches, and occasionally something already living in the uploads folder. The checklist in this skill is the one we run internally, the same discipline behind our writing on hidden technical debt in WordPress and keeping AI coding under control.

Giving it away costs us nothing and might save your site. If you're an agency, run it for your own clients: put your name as the preparer on the report, the tool credit stays in the footer, everyone wins. And while you're here, our other free tool checks the opposite side of site health: the AEO Readiness Checker tests whether AI search engines can read and cite your site.

Frequently asked questions

Is this safe to run on a live production site?

Yes. Every check is read-only: passive observation, version matching, and file inspection. The skill never attempts exploits, never brute-forces logins, and never modifies anything.

Is this tool really free?

Yes. No signup, no trial, no email gate. We built it as a lead-generation asset for our agency, Macronimous — the honest business model is that some people who find serious problems will hire us to fix them. Use it as often as you'd like either way.

Do I need to be technical to use it?

For Remote mode, no; paste your URL into Claude and ask for an audit. Full mode needs SSH access to your hosting account, which most hosts provide in their control panel. The report itself is written in plain language, with the technical detail included for whoever does the fixing.

Which hosts does Full mode work with?

Any host that provides SSH access with WP-CLI: Hostinger, SiteGround, Bluehost, Kinsta, WP Engine, Cloudways, and most VPS setups. The skill includes shared-hosting-specific guidance, like working around ModSecurity rules that block audit requests. If your host offers only a file manager, a reduced version of the config and malware checks still works — slower, but workable.

Does it replace a professional security audit?

It replaces the first 80%: the inventory, the CVE matching, the configuration review, the obvious-compromise check. It does not replace penetration testing or incident response. If it finds evidence of an active compromise, get a professional involved; the skill will tell you when that's the case.

Can I modify or redistribute it?

Yes. MIT licensed. Fork it, adapt it for your agency, share it with your team. We only ask that the tool credit line stays in generated reports.